United Arab Emirates

This page covers cyber threats to the United Arab Emirates. It brings together MITRE ATT&CK, CERT-EU, the Dubai Electronic Security Center and Abu Dhabi Global Market pages, the National Cyber Security Index, and Brandefense research. Brandefense has Dubai ties: we attended the HITEC Innovation & Beyond summit in Dubai in December 2025 (our events archive).

Threat groups that official sources link to the United Arab Emirates

Attribution is stated as given by the named body.

MuddyWater: MITRE ATT&CK (group page last modified 31 July 2026) says MuddyWater has targeted government and private organizations in sectors including telecommunications, local government, finance, defense, and oil and natural gas, in the Middle East, “specifically the UAE and Saudi Arabia”. MITRE attributes MuddyWater to Iran’s Ministry of Intelligence and Security.

MITRE ATT&CK also describes groups that do not have a profile here. It says Moses Staff has targeted government, finance, travel, energy, manufacturing and utility companies outside Israel, including some in the UAE. It lists the United Arab Emirates among the countries targeted by Earth Lusca, an espionage group, and among the countries where AvosLocker ransomware was used as of March 2022. CERT-EU, in Cyber Security Brief 24-03 of February 2024, reports a suspected Iranian actor called UNC1549 targeting aerospace and defense in the Middle East, including Israel and the UAE, linked to the Tortoiseshell cluster and potentially to the IRGC.

Incidents on record

We list only major incidents that officials or major news outlets reported widely. We found no incident in the UAE that meets that bar from sources we could open, so none is listed yet.

How attackers target the United Arab Emirates: Brandefense research

Our own research mentions the UAE in several posts. In summary, as our posts report:

State-linked espionage: our UNC1549 MINIBUS analysis (also as a report) says the suspected Iranian actor targets aerospace and defense organizations in the Middle East, including the UAE, and cites CERT-EU for the link to the Tortoiseshell cluster. The Crafty Camel profile says a March 2025 news report links the name to a campaign against aviation, satellite communications and transport organizations in the UAE, and that the report does not name a state sponsor. The APT33 profile and the Mythic Leopard profile list the UAE among targeted countries, and the Equation Group profile lists it among less heavily targeted countries.

Ransomware: the AvosLocker research summary lists the United Arab Emirates among targeted countries. The VanHelsing profile cites a May 2025 advisory from the UAE Cyber Security Council that describes VanHelsing as a new ransomware strain, with a leak site listing seven victims as of April 2025, mainly in manufacturing and municipal government.

Fraud and hacktivism: the Smishing Triad profile says the group has affiliates in the UAE and has been linked to recruiting money mules and laundering stolen assets through cryptocurrencies in regions including the UAE. It also says its kits copy Dubai Police pages. Our Anonymous Sudan review lists the UAE among countries reached by the group’s DDoS attacks in 2023.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The National Cyber Security Index (NCSI), run by the e-Governance Academy in Estonia and listing the UAE Cyber Security Council as a contributor, says the Council is the governmental body appointed to lead and coordinate cyber security at the national level. It also says the critical information infrastructure policy names critical sectors and lead entities for each sector, and that the Council monitors implementation of the UAE Information Assurance standard. NCSI describes Federal Decree Law No. 34 of 2021 on Combatting Rumours and Cybercrimes as the legal framework for online misuse. These are NCSI statements; we could not open the Council’s own site from our systems.

Dubai has its own body. The Dubai Electronic Security Center says it was founded in 2014 under Law No. 11. Its listed tasks include setting and supervising cyber security standards in Dubai, monitoring compliance by government entities, and preparing a strategic plan for risks, threats or attacks on government information.

How incident response is organized

NCSI describes aeCERT as the UAE computer emergency response team, an initiative of the telecommunications regulator TDRA. It also says the UAE Cyber Security Council developed a Cyber Incident Response Plan that gives guidance for stakeholders at entity, sector and federal levels.

Personal data

NCSI says the UAE implemented new data protection regulations in 2021 and that the UAE Data Office acts as the federal data regulator. This matches the Federal Decree-Law 45 of 2021 on personal data protection, which we could not open on an official page. Separately, the Abu Dhabi Global Market says its Office of Data Protection promotes data protection and keeps the register of data controllers under its Data Protection Regulations 2021.

The sources we opened name no attack counts for the United Arab Emirates. Figures will come from Brandefense Atlas.